---
title: "Networking Fundamentals"
description: "Core networking terms every developer and engineer should know, from IP addressing and DNS to protocols, routing, and the OSI model."
author: "Mohammad Abu Mattar"
canonical: https://mkabumattar.com/glossary/post/networking-fundamentals
---

# Networking Fundamentals

This glossary covers the core networking concepts every developer, DevOps engineer, and system administrator should know, from how data is layered and addressed to how it gets routed across the internet.

## Terms

### OSI Model (Models & Layers)

A 7-layer reference model that describes how data moves through a network, from the physical wires up to the application. The layers are Physical, Data Link, Network, Transport, Session, Presentation, and Application.

**Example:** Engineers often say a problem lives "at Layer 7" to mean an application-level issue rather than a wiring or routing problem.

### TCP/IP Model (Models & Layers)

The 4-layer model that actually runs the internet. Its layers (Link, Internet, Transport, Application) map loosely onto the OSI model but are simpler and reflect how real protocols are built.

### Encapsulation (Models & Layers)

The process of wrapping data with headers (and sometimes trailers) at each layer as it travels down the stack to be sent. The receiving side strips those headers in reverse order.

**Example:** An HTTP request gets wrapped in a TCP segment, then an IP packet, then an Ethernet frame, before going out the wire.

### MAC Address (Models & Layers)

A 48-bit hardware address burned into a network interface card, unique to that physical device. It identifies the device on a local network at Layer 2.

**Example:** 00:1A:2B:3C:4D:5E is a typical MAC address.

### Frame, Packet, Segment (Models & Layers)

The unit of data at different layers. A frame is Layer 2 (Ethernet), a packet is Layer 3 (IP), and a segment is Layer 4 (TCP). Each one adds its own header.

### IP Address (Addressing)

A numerical label assigned to every device on an IP network so that other devices can find and talk to it. Comes in two flavors, IPv4 and IPv6.

### IPv4 (Addressing)

The original 32-bit Internet Protocol address format, written as four numbers separated by dots. It supports about 4.3 billion unique addresses, which the internet has now outgrown.

**Example:** 192.168.1.10 is an IPv4 address.

### IPv6 (Addressing)

The 128-bit successor to IPv4, written as eight groups of four hex digits. The huge address space (340 undecillion addresses) solves IPv4 exhaustion and removes the need for many NAT workarounds.

**Example:** 2001:0db8:85a3:0000:0000:8a2e:0370:7334 is an IPv6 address.

### Subnet (Addressing)

A logical subdivision of an IP network. Splitting a network into subnets lets you organize hosts, control traffic between groups, and apply different security rules to each one.

### CIDR Notation (Addressing)

A compact way to write an IP range as an address plus a slash and the number of network bits. The bits after the slash tell you how many addresses are in the range.

**Example:** 10.0.0.0/24 represents 256 addresses from 10.0.0.0 to 10.0.0.255.

```
# Inspect addresses on Linux
ip addr show
# Calculate ranges
ipcalc 10.0.0.0/24

```

### Private IP Address (Addressing)

An address from a range reserved for internal networks and not routable on the public internet. Three blocks are reserved by RFC 1918, the most common being 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

### Public IP Address (Addressing)

An address that is unique on the public internet and can be reached from anywhere. ISPs and cloud providers assign these from their allocated blocks.

### Loopback (127.0.0.1) (Addressing)

A special address that always refers to the local machine. Anything you send to 127.0.0.1 (or "localhost") never leaves the host, which makes it perfect for testing services on your own machine.

### TCP (Transmission Control Protocol) (Protocols)

A connection-oriented Layer 4 protocol that guarantees ordered, reliable delivery via acknowledgements and retransmissions. Web, email, SSH, and most application traffic ride on TCP.

### UDP (User Datagram Protocol) (Protocols)

A connectionless Layer 4 protocol that fires datagrams without setup, acknowledgements, or retries. It is faster than TCP but unreliable, which suits DNS, video, voice, and gaming.

### HTTP (Protocols)

The Hypertext Transfer Protocol, the request/response protocol of the web. A client sends a method (GET, POST, etc.) to a URL and the server responds with a status code and body.

```
# Quick HTTP request from the terminal
curl -i https://example.com

```

### HTTPS (Protocols)

HTTP wrapped in TLS encryption. The browser and server perform a TLS handshake, agree on keys, then exchange normal HTTP messages over an encrypted channel.

### TLS (Transport Layer Security) (Protocols)

The standard protocol for encrypting traffic on the wire and authenticating servers (and optionally clients) via X.509 certificates. TLS sits between TCP and the application protocol.

### FTP / SFTP (Protocols)

File Transfer Protocol moves files between client and server. Plain FTP is unencrypted and largely deprecated; SFTP (file transfer over SSH) is the secure modern equivalent.

### SSH (Secure Shell) (Protocols)

An encrypted protocol for remote login, command execution, and tunneling. It is the standard way to administer Linux servers and to forward ports securely across networks.

```
# Connect to a remote host on the default SSH port (22)
ssh -i ~/.ssh/key.pem ec2-user@1.2.3.4

```

### ICMP (Protocols)

The Internet Control Message Protocol, used by network devices to send error and diagnostic messages. Tools like ping and traceroute work by sending and listening for ICMP packets.

```
ping example.com
traceroute example.com

```

### ARP (Address Resolution Protocol) (Protocols)

Maps an IP address to a MAC address on a local network. When a host wants to send a packet to a local IP, it broadcasts an ARP request asking "who has this IP?" and caches the reply.

### DNS (Domain Name System) (DNS)

The internet's phone book. DNS turns human-readable names like example.com into IP addresses that machines can route to.

### A Record (DNS)

A DNS record that maps a domain name to an IPv4 address. The AAAA record does the same for IPv6.

```
# Look up the A record for a domain
dig example.com A +short
# Or with nslookup
nslookup example.com

```

### CNAME Record (DNS)

A canonical name record that points one domain name at another. It is the right tool for aliases like www.example.com pointing to example.com.

### MX Record (DNS)

A mail exchange record that tells other mail servers where to deliver email for a domain. Each MX record has a priority value to control failover order.

### TTL (Time to Live) (DNS)

How long a DNS record can be cached by resolvers before it must be looked up again, measured in seconds. Lower TTLs mean faster propagation of changes but more lookup traffic.

### DNS Resolver (DNS)

The DNS client (often run by your ISP, your OS, or a service like 1.1.1.1) that walks the DNS hierarchy on your behalf, caches the result, and returns the final answer to your app.

### Router (Routing & Switching)

A Layer 3 device that forwards packets between different networks by looking at destination IP addresses and consulting a routing table.

### Switch (Routing & Switching)

A Layer 2 device that forwards Ethernet frames between hosts on the same local network, using MAC addresses. Modern switches learn which port each MAC lives on automatically.

### Gateway (Routing & Switching)

A node (almost always a router) that connects one network to another. Hosts use their "default gateway" to send any traffic destined outside their local subnet.

### NAT (Network Address Translation) (Routing & Switching)

A technique where a router rewrites the source IP of outgoing packets so many devices with private IPs can share one public IP. It also keeps inbound connections from reaching internal hosts unless explicitly forwarded.

**Example:** Your home router uses NAT so every device on your LAN can browse the internet through your single ISP-assigned public IP.

### Default Route (Routing & Switching)

The "send anything I do not have a specific route for" entry in a routing table, usually 0.0.0.0/0 pointing at the default gateway.

```
# Show the routing table on Linux
ip route
# See the default gateway
ip route show default

```

### Hop (Routing & Switching)

One step along a packet's journey through routers. Traceroute lists every hop and the round-trip time to each one, which is gold for diagnosing where latency lives.

### Port (Ports & Sockets)

A 16-bit number that identifies a specific service on a host. The combination of IP address and port (a socket) uniquely identifies an endpoint of a network conversation.

### Well-Known Ports (Ports & Sockets)

Ports 0 to 1023, reserved for system services. Common ones include 22 (SSH), 53 (DNS), 80 (HTTP), 443 (HTTPS), and 3306 (MySQL).

### Ephemeral Ports (Ports & Sockets)

The high-numbered ports (typically 49152 to 65535) that the OS picks at random for the client side of a connection. Each outgoing connection your laptop opens grabs one.

### Socket (Ports & Sockets)

The endpoint of a network connection, identified by an IP address and a port. A TCP connection is uniquely defined by a four-tuple of source IP, source port, destination IP, and destination port.

```
# List listening sockets on Linux
ss -tulpn
# Test if a port is open
nc -zv example.com 443

```

### LAN (Local Area Network) (Network Devices)

A network covering a small area, like one home, office, or building. Devices on a LAN can usually talk to each other directly via Ethernet or Wi-Fi without going through the public internet.

### WAN (Wide Area Network) (Network Devices)

A network that spans large geographic distances and connects many LANs together. The public internet is the largest WAN.

### VPN (Virtual Private Network) (Network Devices)

An encrypted tunnel that makes a remote device behave as if it were on a private network. Used for secure remote access to corporate networks and for privacy on untrusted Wi-Fi.

### Firewall (Network Devices)

A device or software layer that filters traffic based on rules (source/destination IP, port, protocol, state). It is the first line of defense for blocking unwanted inbound and outbound connections.

### Load Balancer (Network Devices)

A device or service that spreads incoming requests across a pool of backend servers. It improves throughput, hides individual server failures, and is the foundation of horizontal scaling.

### Proxy (Network Devices)

An intermediary that forwards traffic on behalf of clients (forward proxy) or servers (reverse proxy). Reverse proxies like Nginx and HAProxy commonly sit in front of web apps to handle TLS, caching, and load balancing.

### Latency (Network Devices)

The time it takes a packet to travel from source to destination, usually measured in milliseconds. Unlike bandwidth, latency cannot be improved by adding more capacity, only by shorter paths and faster hops.

### Bandwidth (Network Devices)

The maximum data rate a link can carry, measured in bits per second (Mbps, Gbps). High bandwidth is great for big transfers; low latency matters more for interactive traffic.

### Throughput (Network Devices)

The actual data rate achieved on a network, which is always less than or equal to the bandwidth. Congestion, packet loss, and protocol overhead all eat into it.